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Description 

SUBSTITUTE SPECIFICATION 

PROTECT j=veOR dovico SUITABLE FOR CASCADE circuito CONNECTIONS 
AND CORRESPONDING METHOD FOR SAFETY- related CONDITIONED 

SWITCHING 

[0001] This application is the national phase under 3 5 

U.S.C. § 371 of PCT International Application No. 
PCT/EP2004/007797 which has an International filing date of 
July 14, 2 004, which designated the United States of America 
and which claims priority on German Patent Application number 
103 36 574.5 filed August 8, 2003, the entire contents of which 
are hereby incorporated herein by reference. 

Field 

[0002] The present invention generally relates to a protective 
device for safety-related switching of an electrical unit . For 
example, the device may include having a first input for the 
purpose of receiving a switch-off signal, a second input for 
the purpose of receiving a switch-on signal in the form of a 
switch-on pulse, and an output for the purpose of driving the 
electrical unit. Furthermore, the present invention generally 
relates to a corresponding method for safety-related switching 
of an electrical unit. 

Background 

[0003] In safety-related systems and devices, an emergency- stop 
pushbutton can be provided for the purpose of switching the 
system or device. Shutdown takes place by mcano way of a safety 
device or protective device. 
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[0004] Figure 1 illustrates such a system in the form of a 
block diagram. The protective device 1, which may also be 
referred to as an emergency- stop device, has a multichannel 
input, via which it receives an emergency- stop signal from an 
emergency-stop pushbutton 2. Furthermore, the protective device 
1 has a second input, via which a switch-on signal from an on 
pushbutton 3 can be received. This on pushbutton 3 is in the 
form of a normally open pushbutton. 

[0005] The protective device 1 drives an actuator 4, for 
example a contactor. The actuator 4 for its part switches a 
load contact 5 and, at the same time, a monitoring contact 6. 
In the non-active state of the actuator 4, the load contact 5 
is open and the monitoring contact 6 is closed. 

[000 4 ] -In accordance with the European safety standard EN 954, 
for category 4^_ an automatic restart should not take place 
after an emergency stop on a safety device once the cause of 
the emergency stop has been eliminated. Thio — means — that Thus , 
once an emergency-stop pushbutton has been pressed, it is first 
nccdo — " 
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[0005] -be — latched again for reconnection purposes. In this 
case, the device does not yet start. It is only_ 
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[0006] when an on pushbutton is actuated that the output (s) 
is/are released and the device starts up. 

[0007] In addition, for category 4 of this safety standard 
EN 954, monitoring of the actuators needs to be provided, i.e. 
monitoring contacts 6 of the emergency-stop device 1 or the 
connected actuator 4 need to be introduced into the on- 
pushbutton circuit. As a result, faults on the actuator 4 can 
be recognized. If, for example, the load contact 5 of a 
contactor is welded owing to an overload, the monitoring 
contact 6 is open even if the contactor is not activated. This 
means that the on-pushbutton circuit is interrupted and a 
reconnection is prevented. 

[0008] For category 4 of the safety standard EN 954, it is also 
prescribed that evaluation of the on-pushbutton circuit needs 
to be edge-sensitive. In particular, the falling edge or both 
edges of a switch-on pulse need to be detected. As a result, 
undesired restarting of an electrical device, for example, 
owing to a cross-connection at the inputs or outputs of the 
emergency- stop device 1 can be prevented. 

[0009] In the case of relatively large systems, for example a 
conveyer belt, two or more emergency- stop pushbuttons can be 
provided. In this case, the associated protective devices are 
connected in cascade fashion, as illustrated in figure 2. The 
fundamental design of each circuit group corresponds to that in 
figure 1 . 

[0010] For reasons of clarity, only two stages of a cascade are 
illustrated in figure 2, each stage having a protective device 
or emergency- stop device or an emergency-stop pushbutton. The 
first emergency- stop device 11 is connected to a two-channel 
emergency- stop pushbutton 12, 12'. This in turn likewise drives 
two actuators or contact multipliers 14 and 14' so as to adhere 
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to category 4 of the safety standard EN 954. The actuators 14 
and 14' actuate monitoring contacts 16 and 16' , which are 
connected in series and form, with an on pushbutton 13, an on- 
pushbutton circuit, for example from an external supply voltage 
source (24 V) to the emergency- stop device 11. 
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[0011] In addition, in each case two twin load contacts 15 and 
15' are actuated with the aid of the actuators 14 and 14'. These 
twin load contacts 15 and 15' form, together with a two-channel 
emergency- stop pushbutton 22, 22', an emergency- stop circuit at 
the second emergency- stop device 21. This likewise drives two 
actuators or contact multipliers 24 and 24' which, for their 
part, actuate monitoring contacts 26 and 26' and twin load 
contacts 25 and 25'. The monitoring contacts 26 and 26' form, 
with an on pushbutton 23, the on-pushbutton circuit of the 
emergency- stop device 21. The cascading can be continued 
correspondingly as desired at the twin load contacts 2 5 and 25'. 

[0012] The way in which this cascade circuit functions will be 
described below. If the emergency- stop pushbutton 12, 12' is 
actuated at the first emergency- stop device 11, the actuators 
14, 14' of the emergency- stop device 11 are de-energized. The 
load contacts 15, 15' of these actuators 14, 14', which are 
incorporated in the emergency- stop circuit of the emergency- 
stop device 21, are thus also opened. As is already the case in 
the emergency- stop circuit of the emergency- stop device 11, 
this leads to an interruption in the emergency- stop circuit of 
the emergency- stop device 21. The actuators 24 and 24' of the 
emergency- stop device 21 are therefore also switched off. As a 
result, all of the load circuits in the cascade are switched 
off. 

[0013] If only the emergency- stop pushbutton 22, 22' is 
actuated, only the actuators 24, 24' of the emergency- stop 
device 21 are de-energized. The load monitoring contacts 26, 
26' and the twin load contacts 25, 25' are therefore also de- 
energized. As a result, all of the downstream load circuits in 
the cascade are switched off. The actuators 14, 14' of the 
emergency- stop device 11 remain active. 
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[0012] -In order to switch* the- load circuits on again, the 
emergency- stop pushbutton 12, 12' of the emergency- stop device 
11 is latched again, i.e. the emergency-stop circuit is in a 
closed state. At this point in time, the load circuits are not 
yet complete, however. For this, the on pushbuttons 13 and 2 3 
also need to be 
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[0014] actuated. 

[0015] If the on pushbutton 23 at the emergency- stop device 21 
is actuated first, the emergency- stop device 21 does not switch 
its actuators 24, 24' on since the actuators 14, 14' of the 
emergency- stop device 11 still interrupt the emergency- stop 
circuit of the emergency- stop device 21. In order to switch the 
load circuits on again, initially the on pushbutton 13 of the 
emergency- stop device 11 therefore needs to be actuated. 
Thereupon, the actuators 14, 14' of the emergency- stop device 
11 are driven and the emergency- stop circuit of the emergency- 
stop device 21 is closed. Only now can the emergency- stop 
device 21 be started by actuating its on pushbutton 23. Thio 
means — that Thus , a prescribed sequence needs to be maintained 
for actuating the on pushbutton. However, such an inconvenient 
operating method for systems is unsuitable in industry. 

[0016] A similar safety switching device system has been 
disclosed in document DE 100 11 211 Al . This safety switching 
device system comprioco includes two safety switching devices 
which correspond to one another in terms of their design and 
their operation. The two devices are connected one behind the 
other with an emergency- stop switch connected in between. In 
addition, a starting switch is provided on both devices. 

SUMMARY 

[0017] The An object of at least one embodiment of the present 
invention therefore — conoi at p resides in proposing a protective 
device or protective system and a corresponding method for 
safety-related shutdown of an electrical unit, which device or 
system an d/or method make operation of more complex systems 
more convenient. 
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[0016] - AThia n object is may be ■ achieved according to at least 
one embodiment of the invention by a protective device for the 
safety-related shutdown of an electrical unit having a first 
input for the purpose of receiving a switch-off signal, a 
second input for the purpose of receiving a switch-on signal in 
the form of a switch-on 
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[0018] _pulse, and an output for the purpose of driving the 
electrical unit and by a pulse processing device for the 
purpose of setting the protective device to an activation 
state, in which it can be switched on when the switch-off 
signal is not applied, for a predetermined period of time from 
reception of the switch-on pulse. 

[0019] — In addition, at least one embodiment of the invention 
provides a method for safety-related switching of an electrical 
unit by means of receiving a switch-off signal, switching the 
electrical unit off, receiving a switch-on signal in the form 
of a switch-on pulse, and switching the electrical unit on, it 
being possible to switch the electrical unit on only for a 
predeterminable_ 

[0020] 
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[0019] period of time after ' reception of the switch-on pulse. 

[0020] The switch- on signal — preferably — for example, may 
originates from an on pushbutton. The protective device thus 
receives a single switch-on pulse which generally has the 
binary form L-H-L. 

[0021] The switch-off signal generally originates from a 
latchable emergency- stop pushbutton. The emergency- stop 
pushbutton can thus not be closed unintentionally, which is of 
great importance in terms of safety. 

[0022] The electrical unit, which is switched by the protective 
device, may be an actuator and, in particular, a contactor. As 
a result, load circuits having relatively high currents can 
also be switched easily. 

[0023] The inputs and outputs of the protective device should 
have a plurality of channels. This is prescribed for category 4 
of the safety standard EN 954 and increases the standard of 
safety . 

[0024] The falling edge or both edges of the switch-on pulse 
can advantageously be evaluated by the pulse processing device 
for the purpose of setting the protective device to the 
activation state. This edge sensitivity is likewise prescribed 
by the safety standard mentioned in order that no unintentional 
restarting of the emergency- stop device or protective device 
takes place as a result of cross-connection. 

[0027] — In order to implement the temporally limited activation 
state, the pulse processing device can have a timing element 
which provides an acknowledgment command for the purpose of 
maintaining the activation state for a predetermined time after 
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the switch-on pulse. The protective device can thus be switched 
on for a certain period of time after the switch-on pulse, as 
desired. According to at least one embodiment of the invention, 
response times of the 
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[0025] individual devices with respect to one another can thus 
be taken into account . 
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[0026] In this case, the period of time for the activation 
state i-s — prcf orably m ay be, for example, — set such that it 
corresponds to the activation time of at least one electrical 
unit and/or at least one further switching device. 

[0027 ] Protective devices according to at least one embodiment 
of the invention are particularly advantageously connected to 
form a protective system in the form of a cascade. In this 
case, the first input of a second of the plurality of 
protective devices is driven by the output of one of the 
plurality of protective devices. This also applies, in the same 
manner, to the other cascade stages. 

[0028] The abovementioned period of time for the activation 
state is dimensioned for. this purpose such that it is greater 
than the total of the response times of all of the protective 
devices. This protective system can be switched on by a common 
on pushbutton when the inputs of the plurality of protective 
devices are correspondingly connected. The units or systems 
connected by the protective devices can thus be switched on 
again in a convenient manner after an emergency- stop actuation. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0029] Example embodiments of t^ he present invention will be 
explained in more detail with reference to the detailed 
description and the attached drawings, in which: 

figure 1 shows a block diagram of a safety combination 

according to the prior art; 
figure 2 shows a block diagram of a plurality of cascaded 

safety combinations corresponding to the prior art; 
figure 3 shows a block diagram of cascaded safety combinations 

in accordance with at least one embodiment of the 

present invention, and 
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figure 4 shows a block diagram of the on-pushbutton pulse 

evaluation according to at least one embodiment of 
the invention . 

[0030] The exemplary example embodiments described below 

represent preferred example embodiments of the present 

invention . 
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DETAILED DESCRIPTION OF THE EXAMPLE EMBODIMENTS 

[0033] The intended use of the following example embodiment is, 
as has been mentioned, for example, a conveyer belt, on which a 
plurality of emergency- s topp- 
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[0031] pushbuttons are mounted: However, the conveyer belt 
should only be switched on after an emergency- stop actuation by 
an authorized person. For this purpose, for example a central 
on pushbutton is located at a control station, for example, a 
control cabinet. 

[0032] Figure 3 illustrates, in the form of a block diagram, a 
safety system suitable for this purpose having a plurality of 
emergency- stop devices in a cascade circuit having a common on 
pushbutton. The design is essentially the same as that in 
figure 2, with the result that reference is made to the 
description relating to figure 2 with respect to the same 
elements. One difference from the embodiment in figure 2 is the 
fact that, in the exemplary embodiment in figure 3, only a 
single on pushbutton 3 3 is used which provides an on pulse for 
all of the protective devices or emergency- stop devices. Both 
the monitoring contacts 16 and 16' and the monitoring contacts 
2 6 and 26' are thus in the on-pushbutton circuit. 

[0033] If the emergency- stop devices 11 and 21 have a known 
design, it is not possible to implement the system according to 
category 4 (monitored start/restart) . The reason for this is 
the fact that the on-pushbutton pulse arrives at the downstream 
device 21 before release (unlatching) of the emergency- stop 
circuit 15, 22 or 15' , 22' or the on-pushbutton circuit 26', 
26, 16, 16', 33 is interrupted. If the emergency- stop 
pushbutton 12, 12' is latched again, i.e. closed, for the 
purpose of connecting the system and the common on pushbutton 
33 is actuated (L-H-L pulse) , although the first emergency- stop 
device 11 is switched on, the second emergency- stop device 21 
cannot be switched on. This is because the emergency- stop 
circuit is still interrupted by the second emergency- stop 
device 21 at the time of the on-pushbutton pulse, because the 
actuators of the emergency- stop device 11 only respond to the 
on-pushbutton pulse after a certain response time. 
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[0036] — A very simple solution to this would conoiot — reside in 
the plurality of emergency- stop devices being released by the 
common on 
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[0037] — pushbutton being pressed *a plurality of times. With two 
emergency- stop devices in cascade, 
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[0034] the on pushbutton would thus need to be pressed twice in 
order to switch the system on again. If the emergency- stop 
accessories become more complex, however, small controllers can 
also be used which produce corresponding release pulses for the 
emergency- stop devices. However, this is associated with very 
high costs and is sometimes even impermissible, in particular 
in safety technology . 

[0035] Provision is now made according to at least one 
embodiment of the invention, by modifying the device- internal 
evaluation of the on-pushbutton pulse, for the two emergency- 
stop devices 11 and 21 to be switched on simultaneously with a 
single release command by the on pushbutton 33 and, in the 
process, for the required safety conditions for the emergency- 
stop circuits to be maintained. 

[0036] Figure 4 shows a block diagram illustrating the on 
pushbutton evaluation according to the invention. Accordingly, 
an on-pushbutton signal undergoes edge evaluation 40. In this 
case, the falling edge or both edges of the switch-on pulse are 
evaluated in accordance with the required safety standard. A 
corresponding binary signal 401 is made available to a pulse 
processing device 41. Caid — The pulse processing device 41 
extends the switch-on pulse to a predetermined acknowledgment 
time by a timing element being started. This results in an 
internal acknowledgment command 411 for the further safety 
logic which is provided for a specific time, for example 
500 ms. This evaluation of the on-pushbutton pulse is carried 
out continuously, even if there is no emergency stop at that 
time. If the emergency-stop circuit is then closed within this 
acknowledgment time, the output is driven via the safety logic, 
and the device to be switched is switched on again. 

[00 4 1] This pulse processing according to at least one 
embodiment of the invention results in the following 
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operational sequence for the circuit in figure 3 : the two 
emergency- stop pushbuttons 12, 12' and 22, 22' are already 
closed again . This is done in order to switch the device or 
the system on 
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[00 4 2 ] — again. The on pushbutton 33 is actuated, as a result of 
which the L-H-L pulse 401 
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[0037] known from figure 4 • is 'generated. The emergency- stop 
device 11 switches on. At the same time, the acknowledgment 
time is also started in the emergency- stop device 21. 

[0038] Once the emergency- stop device 11 has closed both 
actuators 14, 14' after a specific response time, the 
emergency- stop device 21 recognizes a closed emergency- stop 
circuit 22, 22' , 15, 15' and likewise switches its actuators 
24, 24' on . This is done on the basis of the acknowledgment 
command which is still present. If the emergency- stop device 11 
does not switch its actuators 14, 14' on owing to a fault, the 
emergency- stop device 21 also does not switch its actuators 24, 
24' on since in this case the emergency- stop circuit 22, 22', 
15, 15' of the second emergency- stop device 21 is open. The 
internal acknowledgment command in the two emergency- stop 
devices 11 and 21 is then cancelled once the acknowledgment 
time has expired. 

[0039] The acknowledgment time is to be selected such that, at 
a desired cascading depth, the internal acknowledgment command 
is even after the individual response or activation times of 
the actuators and emergency- stop devices. This is particularly 
easy to realize in the case of electrical emergency- stop 
devices since their response times are short and thus the 
acknowledgment time may be short. If, on the other hand, the 
acknowledgment time is predetermined in the emergency- stop 
devices, only a certain cascading depth can be achieved 
depending on the response times of the individual devices. 
However, it is necessary to avoid cascading depths which are 
too great since the response time in the event of shutdown via 
the emergency- stop pushbutton brings about a considerable delay 
owing to the cascading. 

[0040] One further advantage results from the fact that all of 
the monitoring contacts 16, 16', 26, 26' are connected in 
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series. If there is a fault in " the downstream emergency-stop 
device 21 or its actuator 24, 24' , the upstream emergency- stop 
device 11 cannot be switched on again either. 

[0041] Example embodiments being thus described, it will be 

obvious that the same may be varied in many ways. Such 

variations are not to be regarded as a departure from the 
spirit and scope of the present invention, and all such 
modifications as would be obvious to one skilled in the art are 
intended to be included within the scope of the following 
claims . 
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